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DETAILED ACTION 
Response to Amendment 

1. This action is in response to the amendment filed on April 19, 2006. Claims 1-18 
are currently being considered. 

Response to Arguments 

2. Applicant's arguments filed April 19, 2006 have been fully considered but they 
are not persuasive for the following reasons: 

Regarding claim 1 , the Applicant argues that the Cited Prior Art (CPA), Conklin et 
al. (U.S. Patent 5,991 ,881), does not teach "detection of a computer virus in information 
transmitted from the terminal apparatus to the central apparatus by the installed anti- 
virus software." This argument is not found persuasive. The CPA discloses a network 
surveillance system (Figure 2), which is situated on a network and monitors and logs all 
communications between terminal apparatuses (column 3 lines 36-61). All the packets 
transmitted between terminal appartuses are also passed through the network 
surveillance system (column 3 lines 51-56). Therefore, it is asserted that traffic between 
a central apparatus and a terminal apparatus is monitored and recorded. Furthermore, 
these recorded logs are examined for possible intrusion patters (column 4 lines 30-34). 
Therefore, the network surveillance system (central apparatus) detects a virus in 
information transmitted between the terminal apparatus and the central apparatus. 
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Furthermore, the Applicant argues that the CPA does not teach "storing a 
communication history of the terminal apparatus." This argument is not found 
persuasive. The CPA states that the central apparatus writes a log of the network traffic 
(column 4 lines 16-29), which is then analyzed for possible intrusion patterns (column 4 
lines 30-39). This logging and recording function is seen as analogous to storing a 
communication history, and therefore, it is asserted that the CPA does teach storing a 
communication history of the terminal apparatus. Furthermore, the Applicant argues 
that the CPA does not teach "specifying the time of infection." This argument is not 
found persuasive. The CPA teaches a continuous monitoring, recording and analyzing 
process, wherein traffic is recorded and analyzed, and if an intrusion is found, a data 
structure is formed with a date-time stamp indicating the time of detection (column 5 
lines 23-32). This is analogous to the time of infection, and therefore, it is asserted that 
the CPA does teach specifying a time of infection. 

In light of the above arguments, the rejection for the pending claims is 
respectfully maintained as given below. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 
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3. Claims 1-18 are rejected under 35 U.S.C. 102(b) as being anticipated by Conklin 
et al. (U.S. Patent No. 5,991 ,881 ). 

Regarding claim 1, Conklin discloses: 

A computer virus infection information providing method for detecting a computer 
virus in information transmitted between a terminal apparatus and a central apparatus 
and providing infection information concerning the detected computer virus, comprising 
the steps of: 

installing anti-virus software on the central apparatus (column 3 lines 40-46); 

storing a communication history of the terminal apparatus (column 4 lines 16-29, 
55-60), wherein the network packets traffic is logged; 

specifying the time of infection of the terminal apparatus based on the stored 
communication history in response to a detection of a computer virus in information 
transmitted from the terminal apparatus to the central apparatus by the installed anti- 
virus software (column 5 lines 23-32), wherein in the continuous process, the intrusion 
detection function identifies the network traffic as reportable, will construct a data 
structure containing a time stamp indicating the time of detection; 

transmitting the infection information including the specified time of infection, 
from the central apparatus to the terminal apparatus (column 5 lines 47-61, column 7 
lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station; and 
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displaying the transmitted infection information by using the terminal apparatus 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Regarding claim 2, Conklin discloses: 

A computer virus infection information providing system for detecting a computer 
virus and providing infection information concerning the detected computer virus, 
comprising: 

a central apparatus (column 2 lines 42-57); and 

a terminal apparatus connected to the central apparatus via a communication 
network (column 2 lines 42-57); 

wherein the central apparatus includes a processor capable of performing 
operations of: 

installing anti-virus software (column 3 lines 40-46); 

storing a communication history of the terminal apparatus (column 4 lines 16-29, 
55-60), wherein the network packets traffic is logged; 

specifying the time of infection of the terminal apparatus based on the stored 
communication history in response to detection of a computer virus in received 
information transmitted from the terminal apparatus by the installed anti-virus software 
(column 5 lines 23-32), wherein in the continuous process, the intrusion detection 
function identifies the network traffic as reportable, will construct a data structure 
containing a time stamp indicating the time of detection; and 
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transmitting the infection information including the specified time of infection, to 
the terminal apparatus (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station; and 

wherein the terminal apparatus includes a processor capable of performing the 
operation of: 

displaying the transmitted infection information (column 5 lines 47-61 , column 7 
lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station and is displayed. 

Regarding claim 1 1 , Conklin discloses: 

An infection information providing apparatus for detecting a computer virus in 
transmitted and received information and providing infection information concerning the 
detected computer virus, comprising a processor capable of performing operations of: 

installing anti-virus software (column 3 lines 40-46); 

storing communication history of the information (column 4 lines 16-29, 55-60), 
wherein the network packets traffic is logged; 

specifying the time of infection of a terminal apparatus based on the stored 
communication history in response to detection of a computer virus in received 
information by the installed anti-virus software (column 5 lines 23-32), wherein in the 
continuous process, the intrusion detection function identifies the network traffic as 
reportable, will construct a data structure containing a time stamp indicating the time of 
detection; and 
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transmitting the infection information including the specified time of infection, to 
the outside (column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert 
message is sent to the console or a management station. 

Regarding claim 15, Conklin discloses: 

A computer memory product readable by a computer and storing a computer 
program for detecting a computer virus in transmitted and received information and 
providing infection information concerning the detected computer virus, the computer 
program comprising the steps of: 

storing a communication history of the information (column 4 lines 16-29, 55-60), 
wherein the network packets traffic is logged; and 

specifying the time of infection of a terminal apparatus based on the stored 
communication history in response to detection of a computer virus in received 
information by anti-virus software (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection. 

Regarding claim 16, Conklin discloses: 

A computer virus infection information providing system for detecting a computer 
virus and providing infection information concerning the detected computer virus, 
comprising: 

a central apparatus (column 2 lines 42-57); and 
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a terminal apparatus connected to the central apparatus via a communication 
network (column 2 lines 42-57); 

wherein the central apparatus includes: 

means for installing anti-virus software (column 3 lines 40-46); 

means for storing a communication history of the terminal (column 4 lines 16-29, 
55-60), wherein the network packets traffic is logged; 

means for specifying the time of infection of the terminal apparatus based on the 
stored communication history in response to detection of a computer virus in information 
transmitted from the terminal apparatus to the central apparatus by the installed anti- 
virus software (column 5 lines 23-32), wherein in the continuous process, the intrusion 
detection function identifies the network traffic as reportable, will construct a data 
structure containing a time stamp indicating the time of detection; and 

means for transmitting the infection information including the specified time of 
infection to the terminal apparatus (column 5 lines 47-61 , column 7 lines 17-23), 
wherein a time-stamped alert message is sent to the console or a management station; 
and 

wherein the terminal apparatus includes means for displaying the transmitted 
infection information (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station and is 
displayed. 



Regarding claim 17, Conklin discloses: 
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An infection information providing apparatus for detecting a computer virus in 
information transmitted to and received from the outside and providing infection 
information concerning the detected computer virus, comprising: 

means for installing anti-virus software (column 3 lines 40-46); 

means for storing a communication history of the information (column 4 lines 16- 
29, 55-60), wherein the network packets traffic is logged; 

means for specifying the time of infection of a terminal apparatus based on the 
stored communication history in response to detection of a computer virus in the 
information received from the outside by the installed anti-virus software (column 5 lines 
23-32), wherein in the continuous process, the intrusion detection function identifies the 
network traffic as reportable, will construct a data structure containing a time stamp 
indicating the time of detection; and 

means for transmitting the infection information including the specified time of 
infection to the outside (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station and is 
displayed. 

Claim 3 is rejected as applied above in rejecting claim 2. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 2, 
wherein the processor of the central apparatus is further capable of performing an 
operation of registering the time of find-out which is the time when the computer virus 
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was found out software (column 5 lines 23-32), wherein in the continuous process, the 
intrusion detection function identifies the network traffic as reportable, will construct a 
data structure containing a time stamp indicating the time of detection, and 

wherein the time of infection is specified based on the stored communication 
history, the registered time of find-out, and the time of installation of the anti-virus 
software which is the time when the anti-virus software was installed, when the 
computer virus is detected by the installed anti-virus software software (column 5 lines 
23-32), wherein in the continuous process, the intrusion detection function identifies the 
network traffic as reportable, will construct a data structure containing a time stamp 
indicating the time of detection. 

Claim 4 is rejected as applied above in rejecting claim 2. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 2, 
wherein the processor of the central apparatus is further capable of performing an 
operation of specifying the route of infection of the computer virus based on the stored 
communication history and the time of installation which is the time when the anti-virus 
software was installed (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and wherein 

the infection information including the specified route of infection and the 
specified time of infection is transmitted, to the terminal apparatus, when the infection 
information is transmitted (column 5 lines 47-61 , column 7 lines 17-23), wherein a time- 
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stamped alert message is sent to the console or a management station and is 
displayed. 

Claim 8 is rejected as applied above in rejecting claim 2. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 
2, wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting advertising information concerning the anti-virus software to 
the terminal apparatus when a computer virus is detected by the anti-virus software 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Claim 12 is rejected as applied above in rejecting claim 1 1 . Furthermore, Conklin 
discloses: 

An infection information providing apparatus according to claim 1 1, wherein the 
processor is further capable of performing an operation of registering the time of find-out 
which is the time when the computer virus is found out (column 5 lines 23-32), wherein 
in the continuous process, the intrusion detection function identifies the network traffic 
as reportable, will construct a data structure containing a time stamp indicating the time 
of detection, and 

the time of infection is specified based on the stored communication history, the 
registered time of find-out, and the time of installation of the anti-virus software which is 
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the time when the anti-virus software was installed, when a computer virus is detected 
by the installed anti-virus software (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection. 

Claim 13 is rejected as applied above in rejecting claim 11. Furthermore, Conklin 
discloses: 

An infection information providing apparatus according to claim 1 1 , wherein the 
processor is further capable of performing an operation of specifying the route of 
infection of the computer virus based on the stored communication history and the time 
of installation which is the time when the anti-virus software was installed (column 5 
lines 26-32), wherein the source and destination IP addresses are recorded; and 

the infection information including the specified route of infection and the 
specified time of infection is transmitted to the outside, when the infection information is 
transmitted (column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert 
message is sent to the console or a management station and is displayed. 

Claim 5 is rejected as applied above in rejecting claim 3. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 3, 
wherein the processor of the central apparatus is further capable of performing an 
operation of specifying the route of infection of the computer virus based on the stored 
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communication history and the time of installation which is the time when the anti-virus 
software was installed (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and wherein 

the infection information including the specified route of infection and the 
specified time of infection is transmitted, to the terminal apparatus, when the infection 
information is transmitted (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station and is 
displayed. 

Claim 6 is rejected as applied above in rejecting claim 3. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 3, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting the installed anti-virus software to a predetermined terminal 
apparatus, wherein the processor of the terminal apparatus is further capable of 
performing operations of: 

installing the transmitted anti-virus software (column 3 lines 40-46); 

storing an execution history of the installed anti-virus software (column 4 lines 
16-29, 55-60), wherein the network packets traffic is logged; and 

transmitting the stored execution history to the central apparatus when a 
computer virus is detected by the anti-virus software (column 4 line 45 - column 5 line 
21), and 
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wherein the processor of the central apparatus is further capable of performing 
the operations of: 

specifying the time of infection based on the transmitted execution history and 
the registered time of find-out (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection; 

specifying the route of infection of the computer virus based on the transmitted 
execution history (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and 

transmitting the infection information including the specified time of infection and 
the specified route of infection, to the terminal apparatus (column 5 lines 47-61 , column 
7 lines 1 7-23), wherein a time-stamped alert message is sent to the console or a 
management station and is displayed. 

Claim 7 is rejected as applied above in rejecting claim 4. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 4, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting the installed anti-virus software to a predetermined terminal 
apparatus, wherein the processor of the terminal apparatus is further capable of 
performing operations of: 

installing the transmitted anti-virus software (column 3 lines 40-46); 
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storing an execution history of the installed anti-virus software (column 4 lines 
16-29, 55-60), wherein the network packets traffic is logged; and 

transmitting the stored execution history to the central apparatus when a 
computer virus is detected by the anti-virus software (column 4 line 45 - column 5 line 
21), and wherein 

the processor of the central apparatus is further capable of performing a 
operations of: 

specifying the time of infection based on the transmitted execution history and 
the registered time of find-out (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection; 

specifying the route of infection of the computer virus based on the transmitted 
execution history (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and 

transmitting the infection information including the specified time of infection and 
the specified route of infection, to the terminal apparatus (column 5 lines 47-61 , column 
7 lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station and is displayed. 

Claim 9 is rejected as applied above in rejecting claim 3. Furthermore, Conklin 
discloses: 
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A computer virus infection information providing system according to claim 3, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting advertising information concerning the anti-virus software to 
the terminal apparatus when a computer virus is detected by the anti-virus software 
(column 5 lines 47-61 , column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Claim 10 is rejected as applied above in rejecting claim 4. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 4, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting advertising information concerning the anti-virus software to 
the terminal apparatus when a computer virus is detected by the anti-virus software 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Claim 14 is rejected as applied above in rejecting claim 12. Furthermore, Conklin 
discloses: 

An infection information providing apparatus according to claim 12, wherein the 
processor is further capable of performing an operation of specifying the route of 
infection of the computer virus based on the stored communication history and the time 
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of installation which is the time when the anti-virus software was installed (column 5 
lines 26-32), wherein the source and destination IP addresses are recorded, and 
the infection information including the specified route of infection and the 
specified time of infection is transmitted, to the outside, when the infection information is 
transmitted (column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert 
message is sent to the console or a management station and is displayed. 

Regarding claim 18, Conklin discloses: 

A computer virus infection information providing method for detecting a computer 
virus in information transmitted between a client and a server and providing infection 
information concerning the detected computer virus, comprising: 

installing anti-virus software on the server apparatus (column 3 lines 40-46); 

detecting the virus and specifying a time of detection (column 5 lines 23-32), 
wherein in the continuous process, the intrusion detection function identifies the network 
traffic as reportable, will construct a data structure containing a time stamp indicating 
the time of detection; 

storing a communication history of the client apparatus software (column 4 lines 
16-29, 55-60), wherein the network packets traffic is logged; 

specifying a time of infection based on the time of detection and the stored 
communication history when the virus is detected by the installed anti-virus software 
(column 5 lines 23-32), wherein in the continuous process, the intrusion detection 
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function identifies the network traffic as reportable, will construct a data structure 
containing a time stamp indicating the time of detection; 

transmitting the infection information including the specified time of infection, 
from the server to the client (column 5 lines 47-61 , column 7 lines 17-23), wherein a 
time-stamped alert message is sent to the console or a management station and is 
displayed; and 

displaying the transmitted infection information at the client (column 5 lines 47- 
61 , column 7 lines 17-23), wherein a time-stamped alert message is sent to the console 
or a management station and is displayed. 

Conclusion 

THIS ACTION IS MADE FINAL Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kaveh Abrishamkar whose telephone number is 571- 
273-3786. The examiner can normally be reached on Monday thru Friday 8-5. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 




